Dillie Privacy Policy

Effective date: October 9, 2026

This English text is a translation of the Korean original (version 2026-10-09), provided for convenience. If there is any inconsistency between this translation and the Korean text, the Korean text prevails.

Gravity8 Inc. (hereinafter the “Company”) values the personal information of Users and complies with the Personal Information Protection Act (Korea) and other relevant laws and regulations. Through this Privacy Policy, the Company informs Users of the purposes for which and the manner in which the personal information provided by Users is used, and of the measures taken to protect personal information.

This Privacy Policy applies to all access channels, including the web, desktop and mobile applications, of “Dillie” (hereinafter the “Service”), a team collaboration messenger service provided by the Company, and when the Company amends this Privacy Policy, it will give notice through this document.

Article 1 (Items of Personal Information Collected and Collection Methods)

The Company collects the minimum personal information as follows for membership registration, provision of the Service, customer consultation, and the like.

1. Items Collected at Membership Registration

Required items: email address, password (or social login account identifier), name, workspace name, and affiliated organization information

Optional items: profile photo, phone number, and department and position information

2. Information Generated or Collected in the Course of Using the Service

Message and chat conversation content and attachments (information that the User directly creates or uploads within the Service)
Meeting (video conference) participation records, meeting recording and audio recording files, and text chat records (only where the User has used the recording or audio recording function)
Calendar event information (content registered by the User, such as title, date and time, attendees, location and description)
When email is linked, the subject, body, attachments, and sender and recipient information of emails sent and received
Service usage records, access logs, access IP information, cookies, device identifiers (device ID), and access browser and OS information
When using payment services, information necessary for payment and settlement (information processed and collected through the payment gateway (PG) provider, such as card issuer name, partial card number and payment approval number)

3. Collection Methods

Direct input by the User, such as membership registration and modification of information, through the website and the Service applications
Collection in the course of consultation through the customer center
Collection of generated information through automatic collection programs in the course of using the Service
Provision from the relevant provider when a social login (Google, Microsoft, etc.) is linked

Article 2 (Purposes of Collection and Use of Personal Information)

The Company uses the collected personal information for the following purposes. Users’ personal information will not be used for any purpose other than those below, and if the purpose of use changes, the Company will take necessary measures, such as obtaining separate consent, in accordance with Article 18 of the Personal Information Protection Act (Korea).

Confirmation of intent to register as a member, identification and authentication for the provision of membership services, and maintenance and management of membership
Provision of Service functions such as messaging and chat, meetings, calendar and email, and support for collaboration between Users
Operation of the Service on a workspace and organization basis (inviting team members, managing permissions, organization settings, etc.)
Payment and settlement of fees, and delivery, identity verification and fee payment in connection with the supply of goods or services
Handling of civil complaints, such as handling customer inquiries and complaints, delivering notices, and providing notice of Service outages
Development of new services and provision of customized services, and improvement of the Service based on Service usage statistics and analysis
Security measures to prevent fraudulent use and unauthorized use and to ensure the stable operation of the Service

Article 3 (Retention and Use Period of Personal Information)

In principle, the Company destroys personal information without delay once the purposes of its collection and use have been achieved. However, upon membership withdrawal, the Company restricts re-registration for 30 days from the date of withdrawal in order to prevent fraudulent use, and may retain the minimum information required for this purpose (email, date and time of withdrawal).

However, where retention is required under the provisions of relevant laws and regulations, the Company retains member information for a certain period prescribed by the relevant laws and regulations.

1. Retention under the Act on the Consumer Protection in Electronic Commerce, etc. (Korea)

Records on contracts or withdrawal of offers, etc.: 5 years
Records on payment and supply of goods, etc.: 5 years
Records on consumer complaints or dispute handling: 3 years

2. Retention under the Protection of Communications Secrets Act (Korea)

3. Retention under the Electronic Financial Transactions Act (Korea)

Records on electronic financial transactions: 5 years

Article 4 (Provision of Personal Information to Third Parties)

The Company processes Users’ personal information only within the scope specified in Article 2 (Purposes of Collection and Use of Personal Information), and, without the User’s prior consent, does not use it beyond that scope and, in principle, does not disclose Users’ personal information externally.

However, the following cases are exceptions.

Where the User has consented in advance to provision to third parties
Where required under the provisions of laws and regulations, or where an investigative agency makes a request for investigative purposes in accordance with the procedures and methods prescribed by laws and regulations
Where provided in a form in which a specific individual cannot be identified, for purposes such as compiling statistics or academic research

Article 4-2 (Transfer of Information to External Services Connected by the User)

(1) The User may connect external applications and AI assistant services (third-party services chosen by the User; hereinafter “Connected Services”) to the Service through an OAuth authorization procedure. When a connection is made, the Company displays the scope of permissions requested by the Connected Service on the consent screen and transfers information only within the scope the User has allowed.

(2) Within the scope allowed by the User, the following information may be transferred to a Connected Service:

Account information: name, email address, and the name and identifier of the Workspace the User belongs to
Project and work information: the name, key, description, status, schedule, owner, and statistics of projects; the title, description, status, assignee, schedule, priority, custom field values, and comments of work items (tasks); the name, goal, schedule, and state of sprints; the field definitions of task lists; and the names, email addresses, profile images (URLs), and project roles of project members
The identifiers (IDs) of each of the above items, their creation and modification times, and the identifiers of the Users who created or modified them
Other information within the Service that the User explicitly requests through the Connected Service

(3) Information is transferred only when the User uses a feature in the Connected Service to make a request, and only to the extent necessary to process that request; the Company does not transfer information on its own initiative. Content that the User writes or enters through a Connected Service is treated as information generated and collected in the course of using the Service under Article 1.

(4) Transferred information is processed by the provider of the Connected Service under that provider’s own privacy policy and terms of service, and the Company is not involved in such processing. Where the provider of the Connected Service is located outside the Republic of Korea, the information is transferred abroad. The User should review the provider’s privacy policy before connecting.

(5) The User may disconnect (withdraw consent) at any time. Upon disconnection, the Company immediately revokes the authentication tokens issued to that Connected Service and stops further transfers. However, deletion of information that was transferred before disconnection must be requested from the provider of the Connected Service. The User may disconnect directly in the Service under Settings › Connected apps, or request disconnection by email to the Privacy Officer (privacy@dillie.work), in which case the Company will process the request as soon as it is confirmed.

Article 5 (Entrustment of Processing of Personal Information)

For the smooth provision of the Service, the Company entrusts personal information processing work to external specialized companies as set out below. When entering into an entrustment contract, in accordance with Article 26 of the Personal Information Protection Act (Korea), the Company clearly stipulates, through a contract or other document, matters concerning the prohibition of processing personal information for purposes other than performing the entrusted work, technical and managerial protective measures, restrictions on re-entrustment, management and supervision of the entrusted service provider, and responsibility such as compensation for damages, and supervises whether the entrusted service provider processes personal information safely.

Entrusted service provider for cloud infrastructure operation (server hosting, data storage)
Entrusted service provider for payment and electronic payment (PG) agency services
Entrusted service provider for notification delivery agency services such as email and SMS
Entrusted service provider for customer consultation and customer service (CS) channel operation

Article 6 (Overseas Transfer of Personal Information)

For the stable provision of the Service, the Company may operate cloud infrastructure (server hosting) and some additional functions (video conferencing, notification delivery, etc.) through providers located overseas, and in such cases Users’ personal information may be transferred overseas. In accordance with Article 28-8 of the Personal Information Protection Act (Korea), the Company carries out an overseas transfer only after notifying Users in advance of the items of personal information transferred, the country to which it is transferred, the time and method of transfer, the name (corporate name) and contact information of the recipient, the recipient’s purposes of use and retention and use period of the personal information, and the measures for protecting personal information, and obtaining their consent, or only in cases where the transfer may be made without separate consent under the law.

When transferring personal information overseas, the Company secures, through a contract with the recipient or other means, safety measures equivalent to the level of personal information protection under the Personal Information Protection Act (Korea).

Article 7 (Procedures and Methods for Destruction of Personal Information)

When personal information becomes unnecessary, such as upon expiry of the retention period or achievement of the purpose of processing, the Company destroys the relevant personal information without delay.

1. Destruction Procedures

Information entered by the User for membership registration and the like is, after the purpose has been achieved, transferred to a separate DB (or, in the case of paper, a separate filing cabinet) and stored for a certain period in accordance with internal policies and other relevant laws and regulations, and is then destroyed. Personal information transferred to the separate DB is not used for any other purpose unless required by law.

2. Destruction Methods

Information in the form of electronic files is deleted using technical methods that make the records impossible to reproduce.
Personal information printed on paper is destroyed by shredding with a shredder or by incineration.

Article 8 (Rights of Users and Legal Representatives and How to Exercise Them)

Users and legal representatives may at any time view or modify the registered personal information of themselves or of a child under the age of 14, and may also request termination of membership (withdrawal of consent).

To view or modify personal information, Users may directly access and correct it through the ‘Settings > Personal Information’ menu in the Service.
To terminate membership (withdraw consent), Users may use the membership withdrawal menu in the Service or contact the Privacy Officer (Chief Privacy Officer) in writing, by phone or by email, and the Company will take action without delay.
Where a User has requested correction of an error in personal information, the Company will not use or provide the relevant personal information until the correction has been completed.
The Company processes personal information terminated or deleted at the User’s request as specified in Article 3 (Retention and Use Period of Personal Information) and ensures that it cannot be viewed or used for any other purpose.

Account Deletion (Membership Withdrawal)

Users of the “Dillie” service provided by Gravity8 Inc. may at any time request deletion of their account and related personal information (membership withdrawal) in accordance with the procedures below.

1. How to Request Deletion

Log in to the web service (dillie.work) and make the request directly at ‘Settings > Profile > Delete Account’.
Alternatively, if you request deletion by email to the Privacy Officer (Chief Privacy Officer) (privacy@dillie.work), the Company will process the request without delay after verifying your identity.

2. Timing of Deletion and Recovery Grace Period

When deletion is requested, the account is changed to ‘scheduled for deletion’ status, and a recovery grace period of 30 days from the date of the request applies. If you log in again during this period, you can recover the account. After the grace period (30 days) has elapsed, the Company destroys the User’s account and personal information (identifying information such as email, phone number, name, nickname and profile image) in accordance with Article 7 (Procedures and Methods for Destruction) and changes the account to deleted status.

3. Data Retained and Retention Period

To prevent abuse through re-registration, the email address and the date and time of withdrawal are retained for 30 days from the date of withdrawal.
Information that must be retained under relevant laws and regulations is retained for the period prescribed by those laws and regulations (see Article 3).

Article 9 (Installation, Operation and Refusal of Devices that Automatically Collect Personal Information (Cookies, etc.))

The Company uses ‘cookies’, which store usage information and retrieve it from time to time, in order to provide customized services to Users.

1. Purposes of Using Cookies

Cookies are used to provide customized services by keeping Users logged in, analyzing access frequency and visit times, identifying Users’ preferences and areas of interest and tracking their traces, and identifying the level of participation in various events and the number of visits.

2. Installation, Operation and Refusal of Cookies

Users have a choice regarding the installation of cookies. Users may refuse the storage of cookies through the option settings in the Tools > Internet Options > Privacy menu at the top of the web browser. However, if Users refuse the storage of cookies, they may have difficulty using some services that require login.

Article 10 (Measures to Ensure the Security of Personal Information)

In accordance with Article 29 of the Personal Information Protection Act (Korea), the Company takes the following technical, managerial and physical measures necessary to ensure the security of personal information.

Encryption of personal information: Users’ passwords are encrypted when stored and managed, and only the User can check and change their personal information.
Technical measures against hacking, etc.: To prevent leakage of and damage to personal information by hacking, computer viruses and the like, the Company installs security programs and carries out periodic updates and inspections, installs systems in areas where access from outside is controlled, and monitors and blocks such access technically and physically.
Restriction of access to personal information: The Company takes necessary measures to control access to personal information by granting, changing and revoking access rights to the database systems that process personal information, and controls unauthorized access from outside by using an intrusion prevention system.
Minimization and training of personnel handling personal information: The Company implements measures to manage personal information by designating the personnel who handle personal information and limiting and minimizing them to those in charge.
Retention of access records and prevention of forgery and alteration: The Company retains and manages records of access to the personal information processing system for at least 6 months, and uses security functions to prevent access records from being forged, altered, stolen or lost.

Article 11 (Privacy Officer and Responsible Department)

To protect Users’ personal information and handle complaints related to personal information, the Company designates a Privacy Officer (Chief Privacy Officer) as follows.

Privacy Officer (Chief Privacy Officer): Jason Kim
Contact: 070-8892-7788
Email: privacy@dillie.work
Affiliation: Gravity8 Inc.

Department Responsible for Personal Information Protection

Users may direct all inquiries concerning personal information protection, complaint handling, remedies for damages and the like arising from their use of the Company’s services to the Privacy Officer (Chief Privacy Officer) and the responsible department. The Company will respond to and handle Users’ inquiries without delay.

Article 12 (Remedies for Infringement of Rights and Interests)

To obtain remedies for infringement of personal information, Users may apply for dispute resolution, consultation and the like to the Personal Information Dispute Mediation Committee, the Personal Information Infringement Report Center (KISA) of the Korea Internet & Security Agency, and others. For other reports of and consultation on infringement of personal information, please contact the agencies below.

Personal Information Dispute Mediation Committee: 1833-6972 (privacy.go.kr)
Personal Information Infringement Report Center (KISA): 118 (privacy.kisa.or.kr)
Supreme Prosecutors’ Office, Cyber Crime Investigation Division: 1301 (spo.go.kr)
Korean National Police Agency, Cyber Bureau: 182 (ecrm.police.go.kr)

Remedies for Rights under Article 35 (Access to Personal Information), Article 36 (Correction or Deletion of Personal Information) and Article 37 (Suspension of Processing of Personal Information, etc.) of the Personal Information Protection Act (Korea)

A person whose rights or interests have been infringed by a disposition or omission of the head of a public institution in connection with the exercise of rights, such as the data subject’s withdrawal of consent to, or requests for access, correction or deletion, or suspension of processing regarding, the processing of personal information, may file an administrative appeal as prescribed by the Administrative Appeals Act (Korea).

Article 13 (Changes to the Privacy Policy and Duty of Notice)

This Privacy Policy applies from its effective date, and in the event of any addition, deletion or correction of changes in accordance with laws and regulations or policies, the Company will give notice through notices within the Service or by email at least 7 days before the changes take effect. However, where a material change to Users’ rights occurs, such as a change in the items of personal information collected or the purposes of use, the Company will give notice at least 30 days in advance.

This Privacy Policy is effective from October 9, 2026.

Revision History

July 10, 2026: Established
October 9, 2026: Article 4-2 (Transfer of Information to External Services Connected by the User) added